xblock-external-ui: Add XBlock API call to render XBlock views

@cpennington @nedbat @ormsbee Can you have a quick look to check that I'm on the right path with this? It seem to work well, rendering either individual blocks or verticals containing both XBlocks and XModules. If that's the correct approach, I'll flesh it out more, add tests and start working on the client side, but I could use a sanity check : ) Thanks!
Is this a potential security vulnerability? This seems like it would allow an attacker to obtain the CSRF token from a victim, and use that to cause the victim to successfully make CSRF-protected requests.